Founder & Chief Technology Officer
I architect and build the systems ZettaByte ships. Tenancy, permissions, audit, billing and payroll are written once and every platform stands on them. One of those systems runs for the Central Taxes Survey Zone, Government of Bangladesh; the rest are linked below and you can open them.
ZettaByte has two founders. Salman runs the business. I run the technology.
That means the architecture every platform stands on, the schema, the security model, the payroll engines, the release pipeline and the production infrastructure — and the engineering standard all of it is held to. When a client asks who designed the system they are buying, the answer is not a department, and I will get on a call and walk through any layer of it.
Most software companies rebuild the same four things for every client: tenancy, permissions, audit, billing. I built them once, properly, and made every platform stand on them.
This is why a client project that matches something we have already built starts at version one instead of at an empty repository, and why a small engineering team ships at the rate it does. The foundation is already written, already in production and already tested. What gets built is the part that makes each business different.
It is also the decision I would defend hardest. It was made when the only question that mattered was how one person ships four products without rebuilding identity, permissions, audit and billing four times.
Live
A national tax survey system running under a Bangladesh government domain — public-sector deployment, with the data governance, access control and audit requirements that come with it.
taxsurvey.gov.bdLive
Multi-tenant HR, attendance and statutory payroll. Payroll is computed to the cent in two countries — Bangladesh income tax, provident fund and gratuity; Canada CPP/CPP2, EI, federal and provincial tax, with year-end T4 and ROE e-file XML. Every rule is built from the tax authority’s own published formulas and proven by automated tests on every commit. The statutory basis is published and dated, with the genuinely unsettled parts marked unsettled.
Open the live demo — no account neededLive, with an Android app on Google Play
A community platform with a companion React Native application, shipped to the Play Store. The mobile client shares its types and business rules with the web codebase, so a calculation is written once rather than three times.
dohsbanani.orgLive
Hospital management — admissions, scheduling, pharmacy, billing and records. The category of system a hospital cannot admit patients without.
hms.zettademos.comLive, taking real orders
Online ordering for a working restaurant — menu, cart, checkout and the order pipeline behind it, on Next.js and Prisma. Real customers place real orders through it, which makes its database production in the way a demo never is.
mughals.zettademos.comLive
Pharmacy and medical-store operations — stock, batches and expiry, purchase and sale, and the dispensing record behind them, behind an authenticated account.
medstore.zettademos.comLive
A community platform — members, groups, notices and the day-to-day administration a residents’ association actually runs on.
community.zettademos.comPublished on the Chrome Web Store
Two browser extensions built around AI workflows, published and maintained on the Chrome Web Store.
Both extensionsPublic, MIT
An MCP memory server with no model inside it. Every other agent memory is an append-only file that rots — a line saying "current focus" with a human instruction above it to keep it fresh, which is a person manually running a decay function. Here a memory is a claim: atomic, independently true or false, and therefore able to carry provenance, be contradicted, be revised, and die.
github.com/joyahmed/palimpsestPrivate repository
A Stable Diffusion pipeline that turns a room type, a style and real dimensions into a rendered interior — diffusers with a DPM-Solver++ multistep scheduler, fp16 on CUDA with a CPU fallback so it still runs on a machine without a GPU, served behind a FastAPI endpoint with a separate enhancement pass over the output. Generative AI as an engineered service rather than a prompt in a notebook.
MIT, on GitHub
Native desktop applications in Rust and Tauri for Windows, macOS and Linux, published open source with the reasoning behind every significant decision — including the builds that were dropped and why.
Read the engineering notesBeyond these, the same foundation carries work across ERP, banking, point-of-sale, wholesale and inventory, pharmacy, real estate, landlord and tenancy, hotel management, food delivery, agro, school and news — some delivered, some as the starting point a new client project begins from. The full list is on the projects page.
Authentication and payroll are not places to be clever. Rotating sessions with reuse detection, short-lived signed tokens in HttpOnly cookies, argon2 hashing, new-device verification, and tenant isolation re-enforced server-side on every request. These are the recommended patterns, implemented correctly across web, API, mobile and desktop. Correct and unsurprising is the goal.
Our platforms run automated tests against the OWASP API Top 10 in CI, and every fix becomes a permanent regression test so it cannot quietly come back. We will not tell you software is unbreakable. We will tell you what we test and how often.
I have had AI assistance for four months. I have been shipping full-stack systems since 2020, and the public repositories go back to 2015 with dates on them — the C# and ASP.NET Core years are all there to read. I mention it because it decides what happens when the tooling is wrong: AI failed for two weeks straight on the authentication flow underneath our platforms, and I built that layer myself. A foundation has to be understood by the person responsible for it, or nobody can fix it at 2am on payroll day.
Next.js, NestJS, PostgreSQL, React Native, Rust with Tauri. Boring, proven and staffable — so when a client eventually brings engineering in-house, they are recruiting for skills people actually have.
My first solo project was a cardiac surgery records system, begun in 2020 — patient admission, then the pre-operative, operative and post-operative stages as separate modules, with role-based access over the top. ASP.NET Core and Entity Framework, about fourteen thousand lines of C# I wrote by hand.
It was too critical a problem for the experience I had. There was no answer on Stack Overflow for what I was stuck on — related questions, no direct solution — and nobody helped. I finished it anyway. It never went live, and it is not code I would write today.
I keep it in mind because it settled a question early: what I can finish when there is no one to ask. Every platform since has been built on that answer.
Shared-foundation platform design across a multi-schema monorepo. Domain modelling for systems that have to stay correct as they grow — schema, migrations, and the boundaries between modules.
REST APIs meant to be consumed by a web client, a mobile client and a desktop client at once, so the contract is the product: versioned routes, predictable resource shapes, consistent error envelopes, cursor pagination, filtering and sorting that behave the same on every endpoint. NestJS over PostgreSQL for the platforms, FastAPI where the work is Python. Every endpoint is permission-gated and tenant-scoped server-side, and the OWASP API Top 10 suite runs against them in CI.
Tenant isolation enforced at the data layer and re-checked server-side on every request. Company merge, inter-entity transfers and per-tenant configuration across every platform type.
Rotating refresh and access tokens with reuse detection, implemented across web, API, mobile and desktop. New-device verification, short-lived signed tokens in HttpOnly cookies, role-based access with field-level data scoping and route-level permission gates.
argon2 password hashing, encryption in transit, sensitive fields encrypted at rest, and automated testing against the OWASP API Top 10 in CI — with every fix retained as a permanent regression test.
Two national tax systems implemented from primary sources — Bangladesh (income tax slabs, exemptions, minimum tax, rebate, provident fund, gratuity, settlements) and Canada (CPP/CPP2, EI with YTD ceilings, federal and provincial tax, T4 and ROE e-file XML). Period locks and reprocess-safe integrity, so a correction cannot corrupt a closed cycle.
React Native, sharing types and business rules with the web codebase so a calculation is written once rather than three times. Shipped to Google Play, and the same codebase targets iOS.
Native applications in Rust with Tauri, using the system webview rather than a bundled browser, so builds ship in megabytes rather than hundreds of them. Cross-compiled and released for all three platforms from one pipeline.
Containerized deployment, CI/CD pipelines, observability, background job queues, and database migrations that are reviewed, versioned and reversible. I provision and maintain our production infrastructure personally — a public VPS and a local server — including hardening, TLS, backups and the deploy pipelines that run against them.
Generative models run as engineered services — a Stable Diffusion interior-design pipeline in PyTorch behind a FastAPI endpoint, with fp16 on CUDA and a CPU fallback. Two AI browser extensions published on the Chrome Web Store. And Palimpsest, an MCP memory server with no model inside it, where a memory is a claim that can decay, be contradicted, be revised and die — rather than another append-only file that quietly goes stale. AI coding tools are in our engineering process daily, with a clear line about which layers are delegated and which are not.
Stripe billing and subscriptions, biometric attendance devices, email and SMS channels, and government and third-party systems — each one wrapped behind our own interface, so a vendor changing their API is a contained change rather than a search across the codebase.
Most of what I build is in private repositories — client systems are confidential and our platform architecture is not something we publish. What is public is the long tail: over a hundred repositories going back to 2015, from the ASP.NET and C# work I started on, through the JavaScript and TypeScript years, to the Rust and Tauri desktop applications we publish today.
The software is the better evidence anyway. Open one of the live systems. Sign into the HRM demo as three different roles and try to see data you should not. That tells you more than a repository would.
If you are evaluating ZettaByte and want to talk to the person who designed the system rather than a salesperson, I am available for that conversation.
